What are the best practices for authorization of Information Security Policy (ISP) in an organization? Elaborate your answer by listing all of them

What are the best practices for authorization of Information Security Policy (ISP) in an organization? Elaborate your answer by listing all of them